Once upon a time, a very long time ago I was a child. I did stupid childish things. I also played relatively sophisticated games of mental torture with my parents, à la “What do you want for Christmas?” “Nothing. Please leave me out of your rituals,” but that’s another story.
On one occasion when I was being particularly childish and stupid, I brought a stray dog into the house. I fed it, pet it, and played with it. In return it bit me in the face. There was blood everywhere. It looked much worse than it was. It looked a bit like a scene from a Stephen King novel. The injury was certainly nowhere near as bad as the subsequent punishment for my actions.
I bring it up because there’s a new stray dog out there. I wouldn’t worry much about it, unless you go out of your way trying to bring it into your “house.” It’s a Trojan horse for Mac OS X named “OSX/MusMinim-A.” The name is meant to be descriptive and roll off your tongue so that you can remember it.
Unlike a virus, or worm, a Trojan is a program that YOU install, and YOU give permission to run. You may not realize you’re doing it because they can be tricky, impersonating normal operations.
Trojans are named for the somewhat apocryphal story of the big wooden horse that was given to the Trojans by the Greeks, only the horse was full of Greek soldiers. The Trojans were actually the dumb guys here. For ten years the Greeks couldn’t get past their firewall uh, gates, then one day they put this horse out there and they all just scurried away. They really just went and hid in the bushes. Sniggering.
Anyway, the Trojans said “Cool! A Gift from the people who’ve been trying to kill us for ten years!” and went and pulled the horse on inside the gates, ignoring the smell, and the strange sound of “Shhh! Shhh!” coming from inside the horse.
(Oh the historical parallels one might draw today.)
Then when all the Trojans were sleeping, or otherwise occupied, the Greeks got out of the horse and started deleting their files, and generally wreaking havoc.
Clearly the Trojans had only themselves to blame for being so gullible. Who do you think they blamed? That’s right. The guy that built the gates that lasted 10 years. They jumped up and down and screaming “Those gates suck! Your gates are no better than Bill’s gates!” They probably had the poor guy crucified.
In the case of Trojan Horse software, YOU are the Trojan. The stupid person. You can avoid this and other malicious software easily, by not going to disreputable websites and downloading pirate software and media.
Apple just released a new demo copy of OS X Lion for developers. It’s already on all sorts of naughty websites and I somehow think it might not be a coincidence that a new Trojan appears when lots of bone head users are downloading things that aren’t meant for them.
This particular Trojan, once you’ve opened the kimono, “… places text files on the system desktop, sends restart, shut down and sleeping commands and runs arbitrary shell commands. The Trojan also displays a fake “administrator password” window to trick users into entering the credentials. MusMinim may display a window, which would only allow users to click reboot option and also send malicious “Unique Resource Locators” (URLs) seeking users to open them….”
This is one reason that I don’t give clients the administrator password to their computers. I set them up as standard users with no ability to install software. I give the passwords to the office administration staff and principals of the company, but not to the general user population. So when windows pop up asking for passwords, they are forced to ask for assistance. This is a good way to run your home computers as well, whether Windows or Mac. Don’t give the kids administrator privileges and Windows security improves DRAMATICALLY.
With a bit of common sense and making sure that privileges are controlled on your computers, I still believe that running security software isn’t a must on a Mac. Yet. Keep in mind there is absolutely NOTHING the operating system, Windows, Mac, or Linux, or whatever can do if we go out of our way to open the gates.
If you would feel safer with security software running on your Mac, I recommend ESET’s Cybersecurity for Mac which just came out. I noticed a little bit of a performance hit while running the beta, but it’s not bad. I might tend to notice it because I have a terminal window open monitoring processes, and seeing it being vigilant attracts my attention. I’ve always been happy with ESET’s NOD-32 for Windows, though I tend to just use Microsoft’s Security Essentials Software and common sense now.
Please for the love of God, don’t install Symantec anything on your computers.
It also seems as though there are always certain companies that find Mac malware. I’m just sayin… they also sell Mac security software, and I’m just sayin… is all.
So be careful, use common sense, and above all else, beware of porn sites bearing gifts.
Hmmm… Backdoors, Greeks, Trojans, porn, hmmm….

Got it! Tahkns a lot again for helping me out!
Pingback: Mac Security, Landsharks, Social Engineering, and Situational Awareness « Thelonious Mac